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Re: Application of Bittrex, Inc. for a License to Engage in Virtual Currency Business Activity 
Pursuant to Part 200 of Title 23 of the New York Codes, Rules and Regulations, and to Engage 
in Money Transmission Activity under the Article 13-B of New York Banking Law 

Dear Mr. Shihara: 

Reference is made to the Bittrex, Inc. (“Bittrex”) application dated August 10, 2015 to engage in Virtual 
Currency Business Activity pursuant to 23 New York Codes, Rules and Regulations (“NYCRR”) Part 200 
and to its application dated July 27, 2018 to engage in money transmission activity pursuant to Article 13- 
B of the New York Banking Law. 

As you are aware, Bittrex has been engaged in Virtual Currency Business Activity in New York under the 
terms of a “safe harbor” permitted by the New York State Department of Financial Services (“the 
Department”). The Department, in recognition of the innovative and evolving nature of the virtual currency 
sector, permitted applicants to engage in Virtual Currency Business Activity under a “safe harbor” during 
the pendency of a license application. As you are also aware, throughout Bittrex’s application process, the 
Department worked steadily with Bittrex to address continued deficiencies and to assist Bittrex in 
developing appropriate controls and compliance programs commensurate with the evolving nature of the 
sector. Since the submission of Bittrex’s application, the Department has issued several deficiency letters, 
among others, regarding Bittrex’s Bank Secrecy Act /Anti-Money Laundering (“BSA /AML”) and Office 
of Foreign Assets Control (“OFAC”) compliance requirements, and coin listing process. It further has 
extensively engaged with Bittrex to outline the necessary steps to satisfy the Department’s licensure 
requirements. Due to the number of unresolved items, in February 2019, a team of examiners from the 
Department conducted a four-week on-site review of Bittrex’s operations at the company’s Seattle and 
Washington, D.C., offices. This included a sampling of transactions dated between January 1, 2017 and 
December 31, 2018. 

Title 23 NYCRR Part 200 requires an applicant for a virtual currency license to demonstrate the “ability to 
comply with the provisions” of licensing requirements. This includes implementing an effective 
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BSA/AML/OFAC compliance program (as well as other measures) to protect customers and the integrity 
of the virtual currency markets. Title 23 NYCRR Part 200.6 and Article 13-B of the New York Banking 
Law direct the Department to investigate the financial condition and responsibility, fmtocial and business 
experience, and character and general fitness of an applicant for either a money transmitter or virtual 
currency license. 

Based on the Department’s extensive review of the information submitted and the Department’s recent 
review of Bittrex’s operations, the Department hereby denies the applications due to the applicant’s failure 
to demonstrate that it will conduct its business honestly, fairly, equitably, carefully and efficiently within 
the purposes and intent of the provisions of Title 23 NYCRR Part 200 and Article 13-B of the New York 
Banking Law, in a manner commanding the confidence and trust of the community. The Department’s 
determination was based primarily on the following; deficiencies in Bittrex’s BSA/AML/OFAC 
compliance program; a deficiency in meeting the Department’s capital requirement; and deficient due 
diligence and control over Bittrex’s token and product launches, 

A. INADEQUATE BSA/AML/OFAC COMPLIANCE PROGRAM 

To prevent illegal money laundering and the evasion of economic sanctions put in place to support U.S. 
national security objectives, the Department requires an entity’s BSA/AML/OFAC compliance program to 
include, at a minimum, the following: 

• Risk-based internal policies, procedures and controls to ensure ongoing compliance; 

• A designated compliance officer with appropriate level of authority and responsibility; 

• Training of employees with respect to BSA/AML/OFAC compliance; 

• Independent testing of the compliance program; and 

• Risk-based procedures for conducting customer due diligence, including the development of 
customer risk profiles and procedures to verify the beneficial owners of corporate customers. 

Bittrex’s BSA/AML/OFAC compliance program fails to meet these requirements as follows: 

I. Inadequate Internal Policies, Procedures and Controls: 

Bittrex’s current policies and procedures are either non-existent or inadequate. For example, they do not 
provide for a strong framework of controls and monitoring to timely detect and report suspicious activities 
and interdict on a real-time basis all prohibited transactions in compliance with OF AC requirements. 
Bittrex’s policies and procedures also do not contain clear guidance for selecting transactions for review, 
or what process will be taken to review an alert for a Suspicious Activity Report (SAR) filing or closing of 
an account. 

No BSA/AML/OFAC compliance program would be adequate or effective if it were not based on a 
comprehensive risk assessment of an entity’s operations, customers and geographies, Bittrex’s risk 
assessment does not comprehensively assess the risks associated with its cryptocurrency activities, products 
offered, nor its customer base or geographies of operation. It also does not contain an analysis of the 
methodology used to support any of the ratings given to the risk areas assessed, including a “moderate” risk 
rating assigned to its BSA/AML/OFAC compliance program. 

Bittrex’s OF AC compliance procedures lack a robust process to remain up-to-date with current OFAC lists. 
The OFAC lists are continually updated to include all entities, such as terrorist groups and foreign regimes, 
subject to U.S, sanctions. Also, Bittrex’s screening process does not use available technologies that would 
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identify the misspelling of names, typographical errors and variations of foreign names. During the 
February review of Bittrex’s operations, the Department’s examiners found that due to such inadequacies, 
a large number of transactions for customers domiciled in sanctioned countries (including Iran and North 
Korea) had passed through screening and were processed. Additionally, Bittrex has developed certain 
practices that are inconsistent with its existing policies and procedures, such as excluding corporate and 
cash customers from its transaction monitoring. 

Further, Bittrex’s transaction monitoring and sanctions compliance program is based on manual processes 
rather than readily available automated processes. For example, Bittrex has developed 21 filtering or 
detection scenarios for monitoring and detecting suspicious activities. However, its manual transaction 
monitoring does not incorporate all 21 filtering or detection scenarios in its alert review process for potential 
SAR filings. Furthermore, while the manual program outlines certain processes for decision making 
regarding SAR filings, such as closing of accounts or approvals, these processes have been inconsistently 
applied and a sample of SARs filed demonstrated elear deficiencies. Also, a review of sample transactions 
by the Department’s examiners has revealed inconsistencies with, and violations of, Bittrex’s own policies 
and procedures. This includes the violation of Bittrex’s multiple account policy, as well as inadequate 
quality control of transactional data. As such, Bittrex’s compliance program is clearly deficient particularly 
given that Bittrex has a customer base of approximately 1.67 million users spread across multiple countries 
(including approximately 35,000 New York-based users), offers 212 cryptocurrencies on its exchange and 
processed over 100 million transactions annually during 2017 and 2018. 

The corporate governance and oversight of Bittrex’s Board of Directors is lacking, as partially evidenced 
by the fact that none of the minutes of the Board of Directors reviewed by the Department’s examiners 
contained any substantive discussion relating to BSA/AML/OFAC issues. 

2. Lack of Qualification or Effectiveness of the Compliance Officer: 

The severity of the deficiencies in Bittrex’s BSA/AML/OFAC compliance program raises significant 
concerns for the Department as to the experience, level of authority and effectiveness of the Compliance 
Officer in discharging his responsibilities. 

3. Lack of Adequate Training of Employees: 

The severity of the deficiencies in Bittrex’s BSA/AML/OFAC compliance program is indicative of a lack 
of a comprehensive training program. The Department’s concern regarding the lack of training is 
compounded as recent hires within the compliance team do not have the requisite BSA/AML/OFAC 
knowledge or expertise. During their review, the Department’s examiners found that BSA/AML/OFAC 
training was not extended to certain staff who were engaged in filing SARs on a batch basis, which is not 
permissible. 

4. Inadequate Independent Testing of the Program: 

Bittrex had retained an external firm to conduct Independent testing of its BSA/AML/OFAC compliance 
program. The firm issued an audit report in January 2019. However, the report failed to reflect the audit 
review period and failed to assess and evaluate the overall integrity and effectiveness of Bittrex’s 
compliance program. Additionally, Bittrex refused to comply with the request of the Department’s 
examiners to share with them the engagement letter between the external audit firm and Bittrex. A review 
of the engagement letter would likely have shed additional light on such independent testing, including the 
scope of the audit. 
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5. Inadequate Customer Due Diligence: 

Bittrex’s Customer Identification Program, Know Your Customer, and Customer Due Diligence are 
seriously deficient as evidenced by the findings of the Department’s examiners during their review of 
sample transactions. For example, examiners found that a large number of transactions were missing 
required tax identification numbers, customer names, or birthdate related information. Others reflected 
missing or inaccurate addresses or contained foreign references without corresponding translations. The 
examiners also found that a substantial number of aliases (e.g., “Give me my money,” “Elvis Presley,” 
“abc-abc,” “Donald Duck,” and other clearly false names) and obscene terms and phrases are used in 
identifying accounts at Bittrex. Also, the “Active Customer File” reviewed by the examiners identified 
several transactions involving customers from OF AC sanctioned countries. 

Additionally, Bittrex has contradictory policies or procedures for identifying ultimate beneficial owners of 
corporate customers. For example, one procedure states that, for non-publicly traded corporate customers, 
benefieial owners will be determined at a 10% level of ownership. A second procedure eontradicts the other 
by requiring such determination to be set at a 25% level of ownership. During their review, the examiners 
found that 60% of the sample of the eorporate customer files did not contain any evidence of due diligence 
to determine their ultimate beneficial owner(s). 

B. LACK OF ADEQUATE DUE DILIGENCE IN LAUNCHING TOKENS OR PRODUCTS 

Bittrex’s “Token Review Policy and Process U.S.” dated November 7, 2018 provides guidelines for the 
review and launeh of tokens and products on its exchange. However, during the examiners’ review of a 
sample of 15 tokens, they were unable to assess compliance with this policy. This was due to the fact that 
partial files were provided to the examiners, and moreover, actual compliance in certain files could not be 
established. For example, in some cases where the token applicants had refused to complete their 
applications — and in one case where there was no application on file at all - the tokens were nevertheless 
accepted for trading and allowed to trade. 

C. INADEQUATE CAPITAL 

Bittrex has not indicated its agreement to comply with the Department’s capital requirement. 

D. DENIAL OF APPLICATIONS AND CEASE AND DESIST ORDER 

Based on the above, Bittrex has failed to demonstrate responsibility, financial and business experience, or 
the character and fitness to warrant the belief that its business will be conducted honestly, fairly, equitably 
and carefully within the purpose and intent of Title 23 NYCRR Part 200 and Article 13-B of the New York 
Banking Law and in a manner commanding the confidence and trust of the community. Therefore, the 
applications are hereby denied.^ Effective April 11,2019, Bittrex must immediately cease operating in New 
York State and doing business with New York State residents.^ Failure to immediately cease such operation 


' Please also note that the applications are being returned to Bittrex with this letter and that, pursuant to 23 NYCRR 
§ 200,5 and New York Banking Law Article 13-B, the application fees submitted by Bittrex will not be refunded. 

2 Title 23 NYCRR § 200.21 provides, in part, that an applicant that applies for a license “within 45 days of the effective 
date of this regulation” shall “be deemed in compliance with the licensure requirements of this Part until it has been 
notified” that “its application has been denied, in which case it shall immediately cease operating in this state and 
doing business with New York State Residents.” 
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and business may subject Bittrex to all applicable penalties for, and enforcement action in regard to, 
violation of the requirements of Title 23 NYCRR Part 200 and New York Banking Law Article 13-B. 

Within 14 days from the date of this letter, please submit to the Department written confirmation that Bittrex 
has immediately ceased operating in New York State and doing business with New York State residents. 
In addition, within 14 days from the date of this letter, please provide a plan for how Bittrex plans to wind 
down its business with existing New York customers. This includes the wind down or transfer of positions 
and transactions, and the safe custody of assets involving New York residents, as appropriate, within 60 
days from the date of this letter. 


Sinpf'TPilv 



Daniel Sangeap 

Deputy Superintendent & Deputy Counsel 
New York State Department of Financial Services 
One State Street, New York, NY 10004-1511 


5 


